Feeds

Dell does factory fresh virus infections?

Something new to be frightened about!

  • alert
  • submit to reddit

Remote control for virtualized desktops

How the hell does a virus-infected set of motherboards find their way into the supply chain of a major system vendor? The vendor delivering the bad boards was Dell, and they’re blaming a slipshod supplier and ‘human error’. Yeah – human error. You can read all about it here and here.

The virus in question was a variant of an easily disinfected worm that was festering in the flash memory on the boards. Dell has removed all of the motherboards from their supply chain and rushed replacements to affected customers. That’s good, but it doesn’t make the fact that this happened in the first place any less deplorable.

To me, this situation brings up a range of disturbing scenarios. First, it proves that malware and other nasty, hidden code can be embedded in factory-fresh products and delivered to unsuspecting customers. This is akin to finding a pile of steaming dog crap when you unwrap your Quarter Pounder. Actually, it’s worse than that – the dog pile is pretty easy to detect in most (but not all) takeout dishes and, while certainly disturbing, you probably won’t end up eating it. A virus or Trojan is different.

It’s fortunate that the virus used was easy to detect. What concerns me is that there are vastly more insidious things that can be done along these lines. Why couldn’t some super-villain plant code in a new system that would lie low until a certain set of conditions are met?

For example: it’s dormant until a particular USB key is inserted into the machine; then it comes to life and opens up all sorts of back doors to the system. This same super-villain would have a low-level minion physically inside the data center with instructions to put the key into server x, wait a few minutes, and then pull the key out. Then the minion would casually walk out the door with gigabytes of confidential data and a big, big smirk.

Admittedly, this wouldn’t be easy to pull off. The bad guy would have to make sure that a particular component lands in the right data center, and that he has an insider in position to execute the plan. (The bad guy or bad gal, that is; I want to be fair, and women can be very evil in their own right.)

But how hard would it be if you had a lot of money behind you – or the resources of an entire government (even a small one)? The targets of these types of schemes won’t be confined to top-secret defense labs; there are plenty of juicy databases in commercial and industrial companies.

One of the people I most respect in the industry gave me the following example of just how harmful these types of exploits could prove to be. Those who know their Star Wars history will recall that then-Chancellor Palpatine used a similar technique to become Emperor. His infamous Order 66 was implanted into the clone army and, at the right moment, they slaughtered their Jedi leaders. Blood flowed red and deep that day, and it became known as The Great Jedi Purge.

(I would hyperlink all of these little factoids, but I can’t stand even to copy and paste the wiki links to this crap. As for my pal, he’s not a Star Wars geek – but he is the father of two boys who watched the movies enough to wear out the DVDs, so he picked up the story via osmosis.)

In conclusion: we need to be concerned about the safety of high tech supply chains and wary of vendors. And ambitious chancellors… and clone programming too, I guess. As for me, I’m off to see if I can get Norton to run on our new microwave.

Intelligent flash storage arrays

More from The Register

next story
The cloud that goes puff: Seagate Central home NAS woes
4TB of home storage is great, until you wake up to a dead device
Azure TITSUP caused by INFINITE LOOP
Fat fingered geo-block kept Aussies in the dark
You think the CLOUD's insecure? It's BETTER than UK.GOV's DATA CENTRES
We don't even know where some of them ARE – Maude
Want to STUFF Facebook with blatant ADVERTISING? Fine! But you must PAY
Pony up or push off, Zuck tells social marketeers
Yahoo! blames! MONSTER! email! OUTAGE! on! CUT! CABLE! bungle!
Weekend woe for BT as telco struggles to restore service
Oi, Europe! Tell US feds to GTFO of our servers, say Microsoft and pals
By writing a really angry letter about how it's harming our cloud business, ta
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
New hybrid storage solutions
Tackling data challenges through emerging hybrid storage solutions that enable optimum database performance whilst managing costs and increasingly large data stores.